Identity thieves don’t need your password anymore. Here are 6 new account takeover threats

You may think of a stolen password as the main way someone gets into your account. But online criminals have learned that they do not always need to steal the password itself. They may hijack an active login session, convince you to approve a sign-in, take control of your phone number or use malware to collect information from your device.

Passwords are still important. However, they are only one part of the security system protecting your identity. Here are six ways criminals may try to get around traditional password protection and the practical steps you can take to protect yourself.

Join our CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us today, Saturday, Oct. 31, at 11 a.m. ET / 8 a.m. PT. Register for free now at CyberGuyLive.com. Missed this morning’s live class? Register at CyberGuyLive.com to watch the replay.

YOUR BANK MAY STOP TEXTING YOU SIX-DIGIT CODES

Cybercriminals can access online accounts without stealing passwords by hijacking login sessions, exploiting security approvals or abusing connected apps. (Photo by Felix Zahn/Photothek via Getty Images)

1. Stolen login sessions

When you sign in to a website, the service often creates a session that tells it you have already proved who you are. Your browser or app may keep that session active so you do not have to enter your password every few minutes. Criminals can sometimes steal the digital tokens or cookies associated with these sessions. If the service accepts the stolen information, an attacker may gain access without entering your password or completing another verification step.

How to protect yourself: Review the devices and active sessions connected to your accounts. Sign out of anything you don't recognize and check for suspicious login activity. We've previously explained how to check for unfamiliar devices and remove them from your Apple, Google and Microsoft accounts. If you suspect unauthorized access, change your password using a trusted device and revoke other sessions when the service allows it. Remember that removing a device from an account list does not always terminate an active login session.

2. SIM swaps and phone account fraud

Your phone number is often connected to email, banking, payment and social media accounts. Criminals may try to convince a mobile carrier to transfer your number to a SIM card or eSIM they control. If the transfer succeeds, they may receive calls and text messages intended for you, including certain account verification codes. A sudden loss of cellular service can be an early warning sign, especially when there is no known local outage. Other signs include an unexpected carrier notification about a device change or a password-reset message you did not request.

How to protect yourself: Ask your carrier about an account security PIN, number transfer lock and port-out protection. These protections vary by carrier. For sensitive accounts, use a passkey, security key or authenticator app when available. Unlike text verification codes, authenticator app codes generally do not depend on your phone number. If text messages are your only available second authentication method, keep them enabled. They still provide more protection than relying on a password alone.

ARE BANK TEXT CODES ENOUGH TO PROTECT YOU?

Stolen session cookies and malicious browser extensions can give hackers access to sensitive accounts, even when strong passwords are in place. (Photo by Britta Pedersen/picture alliance via Getty Images)

3. Fake login approvals and MFA fatigue

Multifactor authentication, or MFA, adds another layer of protection to your accounts. However, criminals sometimes target the person receiving the security request. One tactic is MFA fatigue, also called push bombing. An attacker who can trigger authentication requests repeatedly sends approval notifications, hoping you eventually tap "Approve" to make them stop. Criminals may also impersonate technical support or a financial institution and ask you to read aloud a one-time security code.

How to protect yourself: Never approve a login you did not initiate or share a verification code with someone who unexpectedly contacts you. If repeated prompts appear, deny them and check the account through its official website or app. Change your password if you suspect it has been compromised. When available, choose phishing-resistant authentication, such as a passkey or security key. App-based approvals that require number matching can also offer additional protection against accidental approvals.

4. Malware and risky browser extensions

An infostealer is malicious software designed to collect information from a device. Depending on its capabilities, it may steal browser-stored passwords, session cookies, payment information or other sensitive data. These programs can arrive through fake software updates, pirated applications, suspicious email attachments, malicious advertisements or compromised browser extensions. Some malware operates quietly, which means you may not immediately notice anything unusual.

How to protect yourself: Keep your operating system, browser and security software updated. Avoid downloading software from unfamiliar websites and review browser extensions regularly. If you suspect malware has compromised a device, use a separate, trusted device to secure important accounts. Run a security scan with strong antivirus software and remove suspicious software. For a serious infection, professional assistance or reinstalling the operating system may be necessary. Avoid signing back into sensitive accounts until you are confident the device is secure.

5. Malicious apps with access to your accounts

Some criminals do not need to steal your password or infect your device. Instead, they may trick you into giving a connected application permission to access your information. For example, a fake productivity tool might ask to read your email, access your contacts or manage files in your cloud storage. You may encounter a legitimate-looking permission screen asking you to approve those requests. If you grant access to a malicious app, it may be able to retrieve information through the permissions you approved. In certain cases, that access can continue even after you change your account password. This technique is sometimes called OAuth consent phishing. In a September 2026 warning, the FBI explained that criminals can trick people into granting malicious applications access to their accounts. That access can remain active even after a password change unless the victim revokes the application's permissions.

How to protect yourself: Review the third-party applications connected to your Google, Microsoft and other important accounts. Look closely at what each application can access. Remove permissions for apps you no longer use or do not recognize. Be especially careful with applications requesting access to email, contacts, cloud files or account management features.

Passkeys can help, but they are not the whole answer

Passkeys can significantly reduce the risk of traditional password phishing. They use cryptographic credentials associated with your device, security key or password manager. Unlike a password that you type into a website, a properly implemented passkey is tied to the legitimate website or service. That makes it much harder for a fake login page to steal the credential. However, passkeys do not eliminate every security risk. Criminals may still target an already authenticated session, an infected device, a malicious connected application or an account recovery process.

How to protect yourself: Use passkeys when your important accounts support them. Protect your devices with a strong screen lock and keep recovery information current. If a service offers backup recovery codes, store them securely so you can regain access if your primary device is lost or damaged.

Why changing your password may not be enough

Changing a compromised password is important, but it may not automatically remove every form of unauthorized access. Some services revoke existing sessions after a password change, while others require you to sign out of devices separately.

A criminal might also have established another route into your account, such as an app-specific password, an unauthorized connected application or a new recovery method. Your email deserves particular attention. Someone with access to your inbox could create forwarding rules that quietly send copies of your messages elsewhere.

Review security settings for unfamiliar recovery addresses, connected devices, forwarding rules and app permissions. Remove anything you did not authorize. Also, check whether your password was reused elsewhere. If it was, replace those passwords with unique credentials. A password manager can make this easier without requiring you to memorize every login.

What to do if someone gets around your password

If you suspect an account takeover, act quickly. Start with the account that controls access to your other accounts, usually your primary email.

Here's where to focus:

• Secure your email: Use a trusted device to change your password, revoke suspicious sessions and check recovery information.
• Review connected apps: Remove unauthorized permissions and app-specific passwords.
• Check your phone account: Contact your mobile carrier immediately if you suspect a SIM swap or unauthorized number transfer.
• Protect financial accounts: Review recent transactions and contact your bank or card issuer about suspicious activity.
• Watch for identity theft: Examine your credit reports for unfamiliar accounts or inquiries. Consider placing a fraud alert or credit freeze.
• Preserve evidence: Save security alerts, screenshots, transaction records, case numbers and dates of conversations with financial institutions.

A credit freeze is free and can help prevent criminals from opening new credit accounts in your name. You must contact all three major credit bureaus, Equifax, Experian and TransUnion, to freeze your reports at each bureau. If you believe someone has stolen your identity, visit IdentityTheft.gov for a personalized recovery plan from the Federal Trade Commission.

The value of watching beyond the login

Strong account security is essential, but identity misuse can happen outside the original account. A criminal might use exposed personal information to apply for credit, take over a mobile account or attempt financial fraud without triggering a traditional password alert. That's where an identity theft protection service can provide another layer of monitoring.

These services can monitor certain financial accounts, credit activity and exposed personal information for signs of suspicious activity. Some also provide identity restoration specialists who can help you navigate the recovery process if your identity is stolen. Features vary by provider and plan, and no service can prevent every form of identity theft.

For additional peace of mind, consider a service that offers monitoring, timely alerts and recovery assistance. See my picks for the best identity theft protection services at Cyberguy.com to compare your options and find the right coverage for your needs.

Pro tip: Protect the accounts that unlock everything else

Once a month, review active sessions for your main email and financial accounts. Remove devices you no longer use and check whether your recovery information or connected app permissions have changed. Pay attention to unexpected login alerts, changes to your mobile account and new financial activity. A short monthly security check can help you spot suspicious changes before they become a larger problem.

FAKE CHROME UPDATE SCAM COULD INFECT YOUR COMPUTER

SIM swap scams allow criminals to take control of phone numbers and intercept verification codes used to protect banking, email and social media accounts. (Photo by Donato Fasano/Getty Images)

Kurt's key takeaways

For years, I've told people to use strong passwords and turn on two-factor authentication. I still stand by that advice. But what concerns me now is how criminals can get into accounts without ever knowing the password. Think about someone quietly reading your email through a connected app you forgot about or using a stolen login session to access information you've worked hard to protect. You might change your password and assume everything is fine, while that access remains open. That's why I recommend checking which devices and apps have access to your most important accounts. Start with email and your mobile carrier, because losing control of either can create problems with your financial accounts. And while identity theft monitoring services can help alert you to certain suspicious activity, they work best alongside strong account security. A few minutes reviewing your settings today could save you a great deal of trouble later.

Have you ever received a login approval or password-reset request you didn't initiate, and did you take action or ignore it? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Newsletter

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com - trusted by millions who watch CyberGuy on TV daily.
• Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Copyright 2026 CyberGuy.com. All rights reserved.

Kurt "CyberGuy" Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on "FOX & Friends." Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.